Analysis
-
max time kernel
145s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe
-
Size
212KB
-
MD5
5245490dd86f544ad288db16fb2241bf
-
SHA1
6337b24538e0a54be918e52a38db6367c7b875a5
-
SHA256
5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a
-
SHA512
6699863a582537d763e0f01446787a03b5f7a3d37dec445d8c52630b2538a9cebea62a4dbc4f3da659d6a94a3efbcbc3af707364cb7033fe229afa05ad301eb6
-
SSDEEP
6144:dcyyU/A5rZRLEhFTnRa26s+Wdz8V7Wdfwn1nbmuSDmC:dHp/urb4A1WdBfl
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2220 Program FilesWXDL90.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\d.ico 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe File opened for modification \??\c:\Program Files\Common Files\t.ico 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000d7534d4720fd4fbef5244f759c095a547a62906f142db5265ceccf367ec1fa62000000000e8000000002000020000000ecd95d5ba528259ed1cb28a63ee26dce34d41b5ef7ddf1fd5b5c207c0662b7e220000000fb585a332dda3ee07ea3db38909164b281b81f15087e33cb31846184597505b6400000004d67dd898e8547db62918ca629f49eb002f4ba1fd4a0cdbb735fb9741b3e470e1337e981432e9ba85adeb4998b12b9db2a8e700ec7ef39ad084f176ac604ea19 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6056cfc297e5d801 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E6F28C81-518A-11ED-89AC-DAE60F07E07D} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373154240" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ae3cbe97e5d801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000009ac5346f84aea49f25eb4a389d7acea729f42f34dc57a7cbb1ad8e7ff91e1d3e000000000e8000000002000020000000cb4c341d1e8ed3ea4dea2d7f9bd67c6a9d5395444541edeca061f8871a5b14e320000000c0c0f7bdcc175cb2dae1740a7d479eb8d47c172176cc2be118e81884428aadb04000000085c1f83fb82eb757a5237a63d114e112e58c56b722a10a7062b45f664f84ae54396c89d20efddebab6d7c08aab611810d97d2c32fcdebf1ec6cdcc098153707c IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1193" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1193" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1193" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1193" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.t17t.com/?1193" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1193" 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 784 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 2220 Program FilesWXDL90.exe 784 IEXPLORE.exe 784 IEXPLORE.exe 4244 IEXPLORE.EXE 4244 IEXPLORE.EXE 4244 IEXPLORE.EXE 4244 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4740 wrote to memory of 2220 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 82 PID 4740 wrote to memory of 2220 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 82 PID 4740 wrote to memory of 2220 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 82 PID 2220 wrote to memory of 784 2220 Program FilesWXDL90.exe 84 PID 2220 wrote to memory of 784 2220 Program FilesWXDL90.exe 84 PID 784 wrote to memory of 4244 784 IEXPLORE.exe 85 PID 784 wrote to memory of 4244 784 IEXPLORE.exe 85 PID 784 wrote to memory of 4244 784 IEXPLORE.exe 85 PID 2220 wrote to memory of 4216 2220 Program FilesWXDL90.exe 86 PID 2220 wrote to memory of 4216 2220 Program FilesWXDL90.exe 86 PID 4740 wrote to memory of 3876 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 87 PID 4740 wrote to memory of 3876 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 87 PID 4740 wrote to memory of 3876 4740 5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe"C:\Users\Admin\AppData\Local\Temp\5f746936f55bd660b1ad904019855cc018143b9faafab65d0d4d260894d4ee8a.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\Program FilesWXDL90.exe"c:\Program FilesWXDL90.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:784 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4244
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/PPTV(pplive)_forjieku_977.html3⤵
- Modifies Internet Explorer settings
PID:4216
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵PID:3876
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD56fbbb1d48ebc25bbf05c9167f45ff908
SHA1045d6362c67bf40509e42bf6adfb1ca7d25d4a98
SHA256f3320623fb08f7d5564bf14e9ce870f5c56c8c23fc29056c05b7d37ca97f8db4
SHA5124fc7bf02f18a8cbc562ea485878f6ca4f0197b929b87dc82edebdb764e24c35368deb60650ec4a310d14e6e9c086a813a5b4a44529f2ca0f6eef7f53c58685f3
-
Filesize
486B
MD5ca62f5987432eb3d500c71fc463d0d58
SHA124bbdaf91795bc2342e6e54acab14c9e725ac6af
SHA256e77fbab91ea2f1fb964365458dabb5d9ca70a83d004d527b717030f7601e812e
SHA5129ca5cc5547410b75e2d1ab91e72f88dfdb7b72b552111d6e8050dc0c0ee6d1d1b8947211ee2d69a0ea1264c58c1fcfcad79923e23ff1bbbf64adcc1a0e1a3727
-
Filesize
36KB
MD56fbbb1d48ebc25bbf05c9167f45ff908
SHA1045d6362c67bf40509e42bf6adfb1ca7d25d4a98
SHA256f3320623fb08f7d5564bf14e9ce870f5c56c8c23fc29056c05b7d37ca97f8db4
SHA5124fc7bf02f18a8cbc562ea485878f6ca4f0197b929b87dc82edebdb764e24c35368deb60650ec4a310d14e6e9c086a813a5b4a44529f2ca0f6eef7f53c58685f3